Merge pull request #12 from HideyoshiNakazone/staging

Staging - Implements Buckets, DNS, K3S-Cluster and Fixes Security Group

config.tf

@@ -1,5 +1,9 @@
 ### SET VARIABLES
 
+variable "environment_name" {
+    type = string
+}
+
 variable "project_name" {
     type = string
     default = "hideyoshi-portifolio"

dns/dns.tf

@@ -12,6 +12,10 @@ variable "public_ip" {
     type = string
 }
 
+variable "environment_name" {
+    type = string
+}
+
 
 resource "godaddy_domain_record" "default" {
     domain   = "hideyoshi.com.br"
@@ -19,7 +23,7 @@ resource "godaddy_domain_record" "default" {
     overwrite = false
 
     record {
-        name = "staging	"
+        name = var.environment_name == "prod" ? "@" : "staging"
         type = "A"
         data = "${var.public_ip}"
         ttl = 600
@@ -27,7 +31,7 @@ resource "godaddy_domain_record" "default" {
     }
 
     record {
-        name = "api.staging	"
+        name = var.environment_name == "prod" ? "api" : "api.staging"
         type = "A"
         data = "${var.public_ip}"
         ttl = 600

instances/instance.tf

@@ -5,8 +5,20 @@ terraform {
             version = "5.17.0"
             configuration_aliases = [ aws.main ]
         }
+        tls = {
+            source = "hashicorp/tls"
+            version = "3.1.0"
         }
     }
+}
+
+
+# TERRAFORM SSH KEYS
+
+resource "tls_private_key" "terraform_ssh_key" {
+    algorithm = "RSA"
+    rsa_bits = 4096
+}
 
 
 # EC2 Instances
@@ -22,15 +34,14 @@ resource "aws_key_pair" "ssh_key_ci_cd" {
 }
 
 locals {
-    ports_in = [
+    rules_in = [
-        22,
+        # { "port": 22, "protocol": "tcp" },
-        80,
+        # { "port": 80, "protocol": "tcp" },
-        443,
+        # { "port": 443, "protocol": "tcp" },
-        6443,
+        # { "port": 6080, "protocol": "tcp" },
-        10250
+        # { "port": 6443, "protocol": "tcp" },
-    ]
+        # { "port": 10250, "protocol": "tcp" },
-    ports_out = [
+        { "port": 0, "protocol": "-1" },
-        0,
     ]
 }
 
@@ -38,39 +49,59 @@ resource "aws_security_group" "project_pool" {
     name = "${var.project_name}_pool_security_group"
     description = "Security group for project pool"
 
-    dynamic "egress" {
+    dynamic "ingress" {
-        for_each = toset(local.ports_out)
+        for_each = toset(local.rules_in)
         content {
-            from_port = egress.value
+            from_port = ingress.value["port"]
-            to_port = egress.value
+            to_port = ingress.value["port"]
-            protocol = "tcp"
+            protocol = ingress.value["protocol"]
             cidr_blocks = ["0.0.0.0/0"]
+            ipv6_cidr_blocks = ["::/0"]
         }
     }
 
-    dynamic "ingress" {
+    egress {
-        for_each = toset(local.ports_in)
+        from_port        = 0
-        content {
+        to_port          = 0
-            from_port = ingress.value
+        protocol         = "-1"
-            to_port = ingress.value
-            protocol = "tcp"
         cidr_blocks      = ["0.0.0.0/0"]
+        ipv6_cidr_blocks = ["::/0"]
     }
-    }
+
 }
 
 resource "aws_instance" "main" {
     ami = "ami-0af6e9042ea5a4e3e"
-    instance_type = "t3a.medium"
+    instance_type = "t3a.small"
     vpc_security_group_ids = [ aws_security_group.project_pool.id ]
 
     key_name = aws_key_pair.ssh_key_main.key_name
 
-    user_data   = templatefile("${path.module}/scripts/setup_main.sh", {
+    user_data   = templatefile("${path.module}/scripts/setup_server.sh", {
         extra_key = aws_key_pair.ssh_key_ci_cd.public_key
-        k3s_token = var.k3s_token
+        terraform_key = tls_private_key.terraform_ssh_key.public_key_openssh
     })
 
+    provisioner "remote-exec" {
+        connection {
+            type        = "ssh"
+            user        = "ubuntu"
+            agent       = false
+            private_key = tls_private_key.terraform_ssh_key.private_key_pem
+            host        = self.public_ip
+        }
+        
+        inline = [
+            "echo 'curl -sfL https://get.k3s.io | K3S_TOKEN=\"${var.k3s_token}\" K3S_KUBECONFIG_MODE=644 INSTALL_K3S_EXEC=\"server --disable=traefik\" sh -' >> /home/ubuntu/setup.sh",
+            "echo 'mkdir /home/ubuntu/.kube' >> /home/ubuntu/setup.sh",
+            "echo 'sudo chmod 644 /etc/rancher/k3s/k3s.yaml' >> /home/ubuntu/setup.sh",
+            "echo 'cp /etc/rancher/k3s/k3s.yaml /home/ubuntu/.kube/k3s.yaml' >> /home/ubuntu/setup.sh",
+            "echo 'export KUBECONFIG=/home/ubuntu/.kube/k3s.yaml' >> /home/ubuntu/.profile",
+            "chmod +x /home/ubuntu/setup.sh",
+            "exec /home/ubuntu/setup.sh | tee logs.txt",
+        ]
+    }
+
     tags = {
         Name = "${var.project_name}-main"
     }
@@ -84,12 +115,28 @@ resource "aws_instance" "worker" {
 
     key_name = aws_key_pair.ssh_key_main.key_name
 
-    user_data   = templatefile("${path.module}/scripts/setup_worker.sh", {
+    user_data   = templatefile("${path.module}/scripts/setup_server.sh", {
         extra_key = aws_key_pair.ssh_key_ci_cd.public_key
-        k3s_token = var.k3s_token
+        terraform_key = tls_private_key.terraform_ssh_key.public_key_openssh
-        k3s_cluster_ip = var.project_domain
     })
 
+    provisioner "remote-exec" {
+        connection {
+            type        = "ssh"
+            user        = "ubuntu"
+            agent       = false
+            private_key = tls_private_key.terraform_ssh_key.private_key_pem
+            host        = self.public_ip
+        }
+        
+        inline = [
+            "echo 'curl -sfL https://get.k3s.io | INSTALL_K3S_EXEC=\"agent\" K3S_TOKEN=\"${var.k3s_token}\" K3S_URL=\"${var.project_domain}:6443\" sh -s -' >> /home/ubuntu/setup.sh",
+            "chmod +x /home/ubuntu/setup.sh",
+            "while ! nc -z ${aws_instance.main.public_ip} 6443; do sleep 0.1; done",
+            "exec /home/ubuntu/setup.sh | tee logs.txt",
+        ]
+    }
+
     tags = {
         Name = "${var.project_name}-worker-${count.index+1}"
     }
@@ -101,3 +148,11 @@ resource "aws_instance" "worker" {
 output "pool_master_public_ip" {
     value = aws_instance.main.public_ip
 }
+
+output "pool_master_instance" {
+    value = aws_instance.main
+}
+
+output "pool_worker_instances" {
+    value = aws_instance.worker
+}

instances/scripts/setup_main.sh

@@ -1,12 +0,0 @@
-#!/bin/bash -xe
-
-
-echo -e "\n${extra_key}" >> /home/ubuntu/.ssh/authorized_keys;
-
-echo -e "export TERM='xterm-256color'" >> /home/ubuntu/.profile;
-
-su ubuntu -i << EOF
-# curl -sfL https://get.k3s.io | \
-#         K3S_TOKEN="${k3s_token}" sh -'
-echo "HERE" >> /home/ubuntu/test.txt
-EOF

instances/scripts/setup_server.sh

@@ -0,0 +1,9 @@
+#!/bin/bash
+
+
+echo -e "${extra_key}" >> /home/ubuntu/.ssh/authorized_keys;
+echo -e "${terraform_key}" >> /home/ubuntu/.ssh/authorized_keys;
+
+echo "export TERM='xterm-256color';" > /home/ubuntu/.profile;
+
+exit 0;

instances/scripts/setup_worker.sh

@@ -1,14 +0,0 @@
-#!/bin/bash -xe
-
-
-echo -e "\n${extra_key}" >> /home/ubuntu/.ssh/authorized_keys;
-
-echo "export TERM='xterm-256color'" > /home/ubuntu/.profile;
-
-su ubuntu -i << EOF
-# curl -sfL https://get.k3s.io | \
-#         INSTALL_K3S_EXEC="agent" \
-#         K3S_TOKEN="${k3s_token}" \
-#         sh -s - --server ${k3s_cluster_ip}
-echo "HERE" >> /home/ubuntu/test.txt
-EOF

k3s/k3s.tf

@@ -1,38 +0,0 @@
-module "k3s" {
-  source  = "xunleii/k3s/module"
-  version = "3.3.0"
-  k3s_version = "v1.21.4+k3s1"
-
-  cluster_domain = "civo_k3s"
-
-  drain_timeout            = "60s"
-  managed_fields           = ["label"]
-  generate_ca_certificates = true
-
-  global_flags = [for instance in civo_instance.node_instances : "--tls-san ${instance.public_ip}"]
-
-  servers = {
-    # The node name will be automatically provided by
-    # the module using the field name... any usage of
-    # --node-name in additional_flags will be ignored
-
-    for instance in civo_instance.node_instances :
-    instance.hostname => {
-      ip = instance.private_ip
-      connection = {
-        timeout  = "60s"
-        type     = "ssh"
-        host     = instance.public_ip
-        password = instance.initial_password
-        user     = "root"
-      }
-
-      labels = { "node.kubernetes.io/type" = "master" }
-    }
-  }
-}
-
-output "kube_config" {
-  value     = module.k3s.kube_config
-  sensitive = true
-}

main.tf

@@ -56,4 +56,5 @@ module "dns" {
         godaddy = godaddy
     }
     public_ip = module.instances.pool_master_public_ip
+    environment_name = var.environment_name
 }